From cceca10a8a64e503a1cc21b6333736b400e75e1b Mon Sep 17 00:00:00 2001
From: Yash Tibrewal <yashkt@google.com>
Date: Thu, 13 Jun 2019 17:05:51 -0700
Subject: [PATCH] Fix data race, heap use-after-free issue in
 bm_chttp2_transport

---
 test/cpp/microbenchmarks/bm_chttp2_transport.cc | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/test/cpp/microbenchmarks/bm_chttp2_transport.cc b/test/cpp/microbenchmarks/bm_chttp2_transport.cc
index 05504584c20..a82b10fc178 100644
--- a/test/cpp/microbenchmarks/bm_chttp2_transport.cc
+++ b/test/cpp/microbenchmarks/bm_chttp2_transport.cc
@@ -387,7 +387,7 @@ static void BM_TransportStreamSend(benchmark::State& state) {
   TrackCounters track_counters;
   grpc_core::ExecCtx exec_ctx;
   Fixture f(grpc::ChannelArguments(), true);
-  auto s = std::unique_ptr<Stream>(new Stream(&f));
+  auto* s = new Stream(&f);
   s->Init(state);
   grpc_transport_stream_op_batch op;
   grpc_transport_stream_op_batch_payload op_payload(nullptr);
@@ -450,9 +450,8 @@ static void BM_TransportStreamSend(benchmark::State& state) {
   op.cancel_stream = true;
   op.payload->cancel_stream.cancel_error = GRPC_ERROR_CANCELLED;
   s->Op(&op);
-  s->DestroyThen(MakeOnceClosure([](grpc_error* error) {}));
+  s->DestroyThen(MakeOnceClosure([s](grpc_error* error) { delete s; }));
   f.FlushExecCtx();
-  s.reset();
   track_counters.Finish(state);
   grpc_metadata_batch_destroy(&b);
   grpc_slice_unref(send_slice);